CVE-2026-104445

Summary

YesWiki before 4.6.7 allows unauthenticated attackers to bypass authentication by sending signed Delete or Update activities, potentially deleting or overwriting other actors' federated entries.

Exploitability

Exploitation is relatively straightforward for attackers with an ActivityPub keypair, requiring no user interaction.

Blast radius

If exploited, this vulnerability could result in unauthorized deletion or modification of critical data across the YesWiki network.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to YesWiki 4.6.7 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.